Is CVE-2024-7042 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2024-7042 being exploited in the wild.

How severe is CVE-2024-7042?

Low severity, with a CVSS score of 3, published 29 October 2024.

Which products and versions are affected?

@langchain/community (npm) SEMVER:introduced=0,fixed=0.3.3.

Is there a fix for CVE-2024-7042?

Yes. @langchain/community (npm): upgrade to 0.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2024-7042 attacked?

It is attacked with local access.

Am I affected by CVE-2024-7042?

Check whether you run @langchain/community (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2024-7042: LangChain Community SQL injection in GraphCypherQAChain

CVE-2024-7042 · Severity: low · CVSS 3 · Published 2024-10-29

LangChain Community is a JavaScript library that provides integrations for AI applications with various data sources and services. A prompt injection vulnerability in the GraphCypherQAChain component allows attackers to bypass security controls and execute arbitrary database operations, leading to unauthorized data access, modification, deletion, and potential cross-tenant data breaches in multi-tenant systems.

Technologies: @langchain/community (npm). Vendors: npm.

Quick answers

Is CVE-2024-7042 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2024-7042 being exploited in the wild.
How severe is CVE-2024-7042?: Low severity, with a CVSS score of 3, published 29 October 2024.
Which products and versions are affected?: @langchain/community (npm) SEMVER:introduced=0,fixed=0.3.3.
Is there a fix for CVE-2024-7042?: Yes. @langchain/community (npm): upgrade to 0.3.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-7042 attacked?: It is attacked with local access.
Am I affected by CVE-2024-7042?: Check whether you run @langchain/community (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@langchain/community (npm): upgrade to 0.3.3 or later
```
npm install @langchain/community@0.3.3
```

Technical details

The GraphCypherQAChain class in @langchain/community versions 0.2.5 and earlier is vulnerable to prompt injection attacks that can be leveraged to execute SQL injection. The vulnerability exists in how user input is processed without proper sanitization before being passed to database queries. An attacker can craft malicious prompts that escape the intended query logic, allowing them to create, update, or delete database nodes and relationships, extract sensitive information, or deny service by deleting data. The vulnerability affects all systems using the vulnerable class and is particularly dangerous in multi-tenant environments where data isolation is critical. A fix was released in version 0.3.3.

Affected products

LangChain @langchain/community 0.2.5 and all earlier versions; fixed in 0.3.3

Identifiers

CVE-2024-7042
GHSA-6m59-8fmv-m5f9

Timeline

2024-10-29: disclosed
2024-09-17: patched: Fix commit 615b9d9ab30a2d23a2f95fb8d7acfdf4b41ad7a6 authored on this date

References

https://github.com/langchain-ai/langchainjs/commit/615b9d9ab30a2d23a2f95fb8d7acfdf4b41ad7a6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.